🔴 《严重安全漏洞：CVE-2026-48021》

CVSS 评分: 严重（9.1）　　状态: Received　　发布时间: 2026-07-24

漏洞描述

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This issue has been patched in version 2026-05-20.

🔍 技术细节

字段 值
CVE ID CVE-2026-48021
CVSS 评分 9.1 🔴
严重程度 严重
CVSS 向量 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE 分类 CWE-295,CWE-347
发布时间 2026-07-24
最后更新 2026-07-24
状态 Received
数据来源 security-advisories@github.com

🔗 参考链接